--- ext/exif/exif.c	2009-06-28 14:04:43.000000000 +0200
+++ ext/exif/exif.c.oden	2009-06-28 14:05:12.000000000 +0200
@@ -3219,6 +3219,10 @@ static void exif_process_TIFF_in_JPEG(im
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
 		return;
 	}
+	if (offset_of_ifd > length) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid IFD start");
+		return;
+	}
 
 	ImageInfo->sections_found |= FOUND_IFD0;
 	/* First directory starts at offset 8. Offsets starts at 0. */